Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Encrypt OIDC cookies #12628

Merged
merged 12 commits into from
Feb 6, 2024
Merged

Encrypt OIDC cookies #12628

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
a87fdcf
lxd/auth/oidc: Add constants for session cookie and config refresh in…
markylaing Jan 30, 2024
e76aca7
lxd/auth/oidc: Add fields for secure cookie handling.
markylaing Jan 30, 2024
177bad4
lxd/auth/oidc: Initialise Verifier with fields for cookie encryption.
markylaing Jan 30, 2024
e183169
lxd/auth/oidc: Add method to get securecookie from session ID.
markylaing Jan 30, 2024
0695289
lxd/auth/oidc: Updates methods for getting and setting cookies.
markylaing Jan 30, 2024
87e9296
lxd/auth/oidc: Updates calls to get or set cookies.
markylaing Jan 30, 2024
db3433c
lxd/auth/oidc: Rotate the encryption key of the relying party.
markylaing Jan 30, 2024
8311ab9
lxd: Update calls to NewVerifier.
markylaing Jan 30, 2024
fa47a23
lxd/auth/oidc: Request is not OIDC if session cookie not present.
markylaing Jan 30, 2024
e0a4404
lxd: Fix lint error (revive: confusing-results).
markylaing Feb 5, 2024
bb44108
lxd: Fix lint errors (var-naming).
markylaing Feb 5, 2024
8d4b2e4
lxd: Fix lint errors (revive: unchecked-type-assertion).
markylaing Feb 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 14 additions & 13 deletions lxd/api_1.0.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -454,7 +454,7 @@ func api10Put(d *Daemon, r *http.Request) response.Response {
logger.Debug("Handling config changed notification")
changed := make(map[string]string)
for key, value := range req.Config {
changed[key] = value.(string)
changed[key], _ = value.(string)
}

// Get the current (updated) config.
Expand All @@ -474,7 +474,7 @@ func api10Put(d *Daemon, r *http.Request) response.Response {
d.globalConfigMu.Unlock()

// Run any update triggers.
err = doApi10UpdateTriggers(d, nil, changed, s.LocalConfig, config)
err = doAPI10UpdateTriggers(d, nil, changed, s.LocalConfig, config)
if err != nil {
return response.SmartError(err)
}
Expand All @@ -492,7 +492,7 @@ func api10Put(d *Daemon, r *http.Request) response.Response {
return response.PreconditionFailed(err)
}

return doApi10Update(d, r, req, false)
return doAPI10Update(d, r, req, false)
}

// swagger:operation PATCH /1.0 server server_patch
Expand Down Expand Up @@ -561,10 +561,10 @@ func api10Patch(d *Daemon, r *http.Request) response.Response {
return response.EmptySyncResponse
}

return doApi10Update(d, r, req, true)
return doAPI10Update(d, r, req, true)
}

func doApi10Update(d *Daemon, r *http.Request, req api.ServerPut, patch bool) response.Response {
func doAPI10Update(d *Daemon, r *http.Request, req api.ServerPut, patch bool) response.Response {
s := d.State()

// First deal with config specific to the local daemon
Expand Down Expand Up @@ -601,14 +601,15 @@ func doApi10Update(d *Daemon, r *http.Request, req api.ServerPut, patch bool) re
return fmt.Errorf("Cannot fetch node config from database: %w", err)
}

newClusterHTTPSAddress, found := nodeValues["cluster.https_address"]
if !found && patch {
newClusterHTTPSAddress := ""
newClusterHTTPSAddressAny, found := nodeValues["cluster.https_address"]
if found {
newClusterHTTPSAddress, _ = newClusterHTTPSAddressAny.(string)
} else if patch {
newClusterHTTPSAddress = curConfig["cluster.https_address"]
} else if !found {
newClusterHTTPSAddress = ""
}

if curConfig["cluster.https_address"] != newClusterHTTPSAddress.(string) {
if curConfig["cluster.https_address"] != newClusterHTTPSAddress {
return fmt.Errorf("Changing cluster.https_address is currently not supported")
}
}
Expand Down Expand Up @@ -792,7 +793,7 @@ func doApi10Update(d *Daemon, r *http.Request, req api.ServerPut, patch bool) re
d.globalConfigMu.Unlock()

// Run any update triggers.
err = doApi10UpdateTriggers(d, nodeChanged, clusterChanged, newNodeConfig, newClusterConfig)
err = doAPI10UpdateTriggers(d, nodeChanged, clusterChanged, newNodeConfig, newClusterConfig)
if err != nil {
return response.SmartError(err)
}
Expand All @@ -804,7 +805,7 @@ func doApi10Update(d *Daemon, r *http.Request, req api.ServerPut, patch bool) re
return response.EmptySyncResponse
}

func doApi10UpdateTriggers(d *Daemon, nodeChanged, clusterChanged map[string]string, nodeConfig *node.Config, clusterConfig *clusterConfig.Config) error {
func doAPI10UpdateTriggers(d *Daemon, nodeChanged, clusterChanged map[string]string, nodeConfig *node.Config, clusterConfig *clusterConfig.Config) error {
s := d.State()

maasChanged := false
Expand Down Expand Up @@ -1059,7 +1060,7 @@ func doApi10UpdateTriggers(d *Daemon, nodeChanged, clusterChanged map[string]str
d.oidcVerifier = nil
} else {
var err error
d.oidcVerifier, err = oidc.NewVerifier(oidcIssuer, oidcClientID, oidcAudience)
d.oidcVerifier, err = oidc.NewVerifier(oidcIssuer, oidcClientID, oidcAudience, s.ServerCert, nil)
if err != nil {
return fmt.Errorf("Failed creating verifier: %w", err)
}
Expand Down
2 changes: 1 addition & 1 deletion lxd/api_cluster.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -781,7 +781,7 @@ func clusterPutJoin(d *Daemon, r *http.Request, req api.ClusterPut) response.Res
changes[k], _ = v.(string)
}

err = doApi10UpdateTriggers(d, nil, changes, nodeConfig, currentClusterConfig)
err = doAPI10UpdateTriggers(d, nil, changes, nodeConfig, currentClusterConfig)
if err != nil {
return err
}
Expand Down
Loading
Loading